I've started with a clean clone and walked through the kickstart. I have updated the specific lambda handler to include my email address. I also create a user with that email address. However, I do not get added to a specific admin group. I see the user added to a group whose name I supplied during the init ("jammies" in my case).

Looking through the code, it appears that this group name is what's sent to the PostConfirmation handler as the GROUP env variable. So, my user is, I think, being recognized as an admin, but that only causes it to get added to my 'jammies' group. I guess during the init it was asking me for the admin group name.

However, the fact that my user is in that group doesn't seem to matter, as I don't see the 'Admin' menu option and if I go there manually then all POSTs to the backend fail.

I noticed that in my Cognito setup I only have a PostConfirmation trigger and nothing else. Is that right?

I don't see what mechanism would be setting the page context's isAdmin and allowing me to see the menu (or successfully make calls).